Business — Banking — Management — Marketing & Sales

The past decade has seen dramatic losses in the banking industry. Firms that had been performing well suddenly announced large losses due to credit exposures that turned sour, interest rate positions taken, or derivative exposures that may or may not have been assumed to hedge balance sheet risk. In response to this, commercial banks have almost universally embarked upon an upgrading of their risk management and control systems.

Coincidental to this activity, and in part because of our recognition of the industry’s vulnerability to financial risk, the Wharton Financial Institutions Center, with the support of the Sloan Foundation, has been involved in an analysis of financial risk management processes in the financial sector. Through the past academic year, on-site visits were conducted to review and evaluate the risk management systems and the process of risk evaluation that is in place. In the banking sector, system evaluation was conducted covering many of North America’s super-regionals and quasi-money center commercial banks, as well as a number of major investment banking firms. These results were then presented to a much wider array of banking firms for reaction and verification.

The purpose of the present paper is to outline the findings of this investigation. It reports the state of risk management techniques in the industry — questions asked, questions answered and questions left unaddressed by respondents. This report can not recite a litany of the approaches used within the industry, nor can it offer an evaluation of each and every approach. Rather, it reports the standard of practice and evaluates how and why it is conducted in the particular way chosen. But, even the best practice employed within the industry is not good enough in some areas. Accordingly, critiques also will be offered where appropriate. The paper concludes with a list of questions that are currently unanswered, or answered imprecisely in the current practice employed by this group of relatively sophisticated banks. Here, we discuss the problems which the industry finds most difficult to address, shortcomings of the current methodology used  to analyze risk and the elements that are missing in the current procedures of risk management and risk control.

What Type of Risk Is Being Considered ?

Commercial banks are in the risk business. In the process of providing financial services, they assume various kinds of financial risks. Over the last decade our understanding of the place of commercial banks within the financial sector has improved substantially. Over this time, much has been written on the role of commercial banks in the financial sector, both in the academic literature2 and in the financial press. These arguments will be neither reviewed nor enumerated here. Suffice it to say that market participants seek the services of these financial institutions because of their ability to provide market knowledge, transaction efficiency and funding capability. In performing these roles they generally act as a principal in the transaction,. As such, they use their own balance sheet to facilitate the transaction and to absorb the risks associated with it.

To be sure, there are activities performed by banking firms which do not have direct balance sheet implications. These services include agency and advisory activities such as (i) trust and investment management, (ii) private and public placements through «best efforts» or facilitating contracts, (iii) standard underwriting through Section 20 Subsidiaries of the holding company, or (iv) the packaging, securitizing, distributing and servicing of loans in the areas of consumer and real estate debt primarily. These items are absent from the traditional financial statement because the latter rely on generally accepted accounting procedures rather than a true economic balance sheet. Nonetheless, the overwhelming majority of the risks facing the banking firm is in on-balance-sheet businesses. It is in this area that the discussion of risk management and the necessary procedures for risk management and control has centered. Accordingly, it is here that our review of risk management procedures will concentrate.